CVE-2026-72784

CVE-2026-72784 affects Craft CMS versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1. The vulnerability is a server-side request forgery (SSRF) in the GraphQL saveAsset mutation that fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

EUVD-2026-56094

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

EUVD-2026-56045

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606

Pinry (through version 2.1.13) is affected by a Server-Side Request Forgery (SSRF). The vulnerability arises in the pin-from-URL feature: it passes user-supplied URLs directly to requests.get() without host/IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true, enabling anonymous triggering...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

EUVD-2026-56037

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

CVE-2026-72598 affects Apioo Fusio 8.8.3. A server‑side request forgery occurs when authenticated consumer‑role users register a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax with FILTER_VALIDATE_URL but imposes no IP or host denylist. When the r...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72597

CVE-2026-72597 affects Friendica (2026.08-dev branch). The vulnerability is a server-side request forgery (SSRF) in the link-preview endpoint, which fetches a user-provided URL without an internal IP deny list. This allows an authenticated user with a free self-registered account to probe interna...

EUVD-2026-56036

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72560

CVE-2026-72560 affects HumanSignal Label Studio (up to 1.24.0.dev0). The import-from-URL endpoint can fetch caller-supplied URLs, including internal loopback addresses, because SSRF_PROTECTION_ENABLED is false by default in the default installation. An authenticated user could use this to reach i...

CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...